Question

当前使用PHP来运行一些注册/登录系统。情况如下：

我的第一页名为“ signup.php”，用于注册和登录。提交表单后，您将重定向到第二页“ diary.php”。单击提交按钮后，将在“用户”数据库中分别使用您的ID创建一个会话。没有diary.php，有一个注销链接。如果您注册或登录，并且现在正在查看diary.php，则除非按注销，否则您将无法查看signup.php页面。按注销后，您将被重定向到signup.php页面，但是$ _GET数组中包含注销变量。

<a href='signup.php?logout=1'>Logout</a>

我正在使用此注销变量来检查$ _GET数组中是否存在“注销”键，它会破坏会话并将我重定向回signup.php页面。

现在是问题所在。假设我注册了一个新帐户，然后注销。我注销后，GET中将有一个“注销”键，对吗？（以破坏会话）。如果我尝试注册另一个帐户，它实际上是要在数据库上注册我，但是由于我的链接中有注销密钥，并且因为没有会话，所以它会自动为我注销。在我的代码中，如果没有会话，几行代码会自动将您带回signup.php。

我希望这足以使大家都明白。我将把我两页的代码留给您检查。谢谢！

signup.php

session_start();

 $conn = mysqli_connect("localhost","root","","diary");


 $error = '';
 $success = '';

if (array_key_exists("submit",$_POST)) {
    if (!$_POST['email']) {
        $error.= "Email field is missing.<br>";
    }

    if (!$_POST["password"]) {
        $error .= "Password field is missing.<br>";
    }

    if ($error != '') {
        $error = "Fill in the missing field(s):<br>".$error;
    }

    else if ($_POST["submit"] == "Sign up") {
        $email = $_POST["email"];
        $query = "SELECT * FROM users WHERE email = '$email';";
        $result = mysqli_query($conn,$query);
        if (mysqli_num_rows($result) != 0) {
            $error .= "This account already exists!";
        } else {
            $email = $_POST["email"];
            $password = $_POST["password"];
            $query1 = "INSERT INTO users (email,password) VALUES ('$email','$password');";
            mysqli_query($conn,$query1);
            $success.= "Successfully signed up!";
            $query = "SELECT id FROM users WHERE email = '$email';";
            $row = mysqli_fetch_array(mysqli_query($conn,$query));
            $id=$row["id"];
            $_SESSION["id"] = $id;
            header("Location: diary.php");

            if (!isset($_POST["signUpRemember"])) {
            } else {
                setcookie("id",$id,time() + 60*60*24*30);
            }            
        }
    }  else if ($_POST["submit"] == "Login")  {

        $email = $_POST["email"];
        $password = $_POST["password"];
        $query = "SELECT * FROM users WHERE email = '$email';";
        if (mysqli_num_rows(mysqli_query($conn,$query)) == 0) {
            $error.= "This account does not exist, sign up for a new account!";        
        } else {
            $query = "SELECT password FROM users WHERE email = '$email';";
            $rows = mysqli_fetch_array(mysqli_query($conn,$query));
            if ($password != $rows["password"]) {
                $error.= "You have inserted the wrong password for this account. Please, try again!";
            } else {
                $query = "SELECT id FROM users WHERE email = '$email';";
                $rows = mysqli_fetch_array(mysqli_query($conn,$query)); 
                $_SESSION["id"] = $rows["id"];
                if (!isset($_POST["signUpRemember"])) {
            } else {
                setcookie("id",$rows["id"],time() + 60*60*24*30);
            }    
                header("Location :diary.php");
            }

        }

    }
}

 if (array_key_exists("logout",$_GET)) {

     unset($_SESSION["id"]);
     setcookie("id","",time() - 60*600);


 } 

if (array_key_exists("id",$_SESSION)) {
    header("Location: diary.php");

}

?>

    <!-- Bootstrap CSS -->
    <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.1.2/css/bootstrap.min.css" integrity="sha384-Smlep5jCw/wG7hdkwQ/Z5nLIefveQRIY9nfy6xoR1uRYBtpZgI6339F5dgvm/e9B" crossorigin="anonymous">
    <script src="https://code.jquery.com/jquery-3.3.1.slim.min.js" integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo" crossorigin="anonymous"></script>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/popper.min.js" integrity="sha384-ZMP7rVo3mIykV+2+9J3UJ46jBk0WLaUAdn689aCwoqbBJiSnjAK/l8WvCWPIPm49" crossorigin="anonymous"></script>
    <script src="https://stackpath.bootstrapcdn.com/bootstrap/4.1.2/js/bootstrap.min.js" integrity="sha384-o+RDsa0aLu++PJvFqy8fFScvbHFLtbvScb8AjopnFD+iEQ7wo/CG0xlczd+2O/em" crossorigin="anonymous"></script>

    <title>Secret Diary</title>
      <style>

          body {
              margin:0;
              height: 0;
          }
          #error {
              background-color: red;
          }
          body {
                background-image: url("img/bg.jpg");
                background-color: #cccccc;
            }

          #containerLogin {
                margin: auto;
                width: 30%;
                padding: 10px;
                margin-top: 5%;
          }

          #containerSignup {
                margin: auto;
                width: 30%;
                padding: 10px;
                margin-top: 5%;

          }


          .switchBtt {
              margin-top: 5%;
              width: 70%;
          }

          .display-4 {
              font-weight: 300;
          }



      </style>
  </head>
  <body>

      <div id="error"><?php if ($error != "") { echo $error; } else { echo "<script>$( '#error' ).css('background-color', 'green');</script>"; echo $success;} ?></div>
      <div id="containerLogin">
       <center><h1 class="display-4 text-muted "><font color="#6D3E6C">Secret Diary</font></h1>
           <br>
                 <h5 class=" text-muted "><font color="#DFD2CA">Welcome back!</font></h5>
           <br>
     <form method="post" name="signup">
  <div class="form-group">


    <label for="email">Email address</label>
    <input type="email" class="form-control" name="email" aria-describedby="emailHelp" placeholder="Enter email">
    <small id="emailHelp" class="form-text text-muted">We'll never share your email with anyone else.</small>
  </div>
  <div class="form-group">
    <label for="password">Password</label>
    <input type="password" class="form-control" name="password" placeholder="Password">
  </div>
  <div class="form-group form-check ">
    <input type="checkbox" class="form-check-input" value="checked" name="signUpRemember">
    <label class="form-check-label" for="signUpRemember">Keep me signed in</label>
  </div>
  <input class="btn btn-primary" type="submit" value="Login" name="submit">
 </form>
           <div  class="btn btn-secondary switchBtt">Switch to sign-up panel &#x21B9; </div>

    </center>

      </div>
            <div id="containerSignup">
       <center><h1 class="display-4 text-muted "><font color="#6D3E6C">Secret Diary</font></h1>
           <br>
                 <h5 class="text-muted "><font color="#DFD2CA">Sign up today, for free!</font></h5>
           <br>
     <form method="post" name="signup">
  <div class="form-group">
    <label for="email">Email address</label>
    <input type="email" class="form-control" name="email" aria-describedby="emailHelp" placeholder="Enter email">
    <small id="emailHelp" class="form-text text-muted">We'll never share your email with anyone else.</small>
  </div>
  <div class="form-group">
    <label for="password">Password</label>
    <input type="password" class="form-control" name="password" placeholder="Password">
  </div>
  <div class="form-group form-check ">s
    <input type="checkbox" class="form-check-input" value="checked "name="LoginRemember">
    <label class="form-check-label" for="LoginRemember">Keep me signed in</label>
  </div>
  <input class="btn btn-primary" type="submit" value="Sign up" name="submit">
 </form>
           <div class="btn btn-secondary switchBtt">Switch to login panel &#x21B9; </div>

    </center>
      </div>

    <!-- Optional JavaScript -->
    <!-- jQuery first, then Popper.js, then Bootstrap JS -->

  </body>
    <script>
        $("#containerLogin").hide();
        $(".switchBtt").click (function () {
          $("#containerLogin").toggle();
          $("#containerSignup").toggle();
        });
    </script>
</html>

diary.php

session_start();

    if (array_key_exists("id",$_SESSION)) {
        echo "<p>Logged In! <a href='signup.php?logout=1'>Logout</a></p>";
        echo "<br>";
        echo $_SESSION["id"]."<br>";
    } else {
        header("Location: signup.php");
    }

    ?>

Answer 1

出于这个确切的原因，通常不应该使用GET查询字符串来更改应用程序中的状态。

GET requests are not supposed to have any side effects，浏览器将尝试利用此优势来加快页面加载，方法是在用户单击页面之前预先请求页面，或者通过缓存页面而不实际从服务器请求页面。这些情况中的任何一种都会导致意外行为。另外，如果有人在页面上加？logout = 1标记为书签，则他们（很可能是偶然地）在返回页面时注销自己。

为此最好使用POST动词。您可以轻松地使用HTML

标记和提交按钮来完成此操作：

<form action="signup.php" method="POST" id="logout_form">
    <input type="hidden" name="logout" value="1" />
    <input type="submit" value="Logout" />
</form>

在您的PHP中，您可以通过执行以下操作来检测是否有人按下了按钮：

if(isset($_POST['logout'])) {
    //log user out
}

Answer 2

Michael的答案是一个很好的答案（并且被接受！），但是在我工作的那一刻，我正在接受一项可访问性审核，所以我想到了这一点。屏幕阅读器，使用高对比度自定义样式表的人等都无法像使用纯文本一样轻松地处理表单按钮。

我在使用session_destroy的（旧）PHP清除会话中也遇到了问题，因此我遍历了会话变量和unset。

<a href="/logout.php">Log out</a>

然后注销.php：

<?php

session_start();

foreach($_SESSION as $sk=>$sv){
  unset($_SESSION[$sk]);
}

header("location: /");

?>

正确设置注销链接

2 个答案: